What's the mean of PIN cache in smart card csp

Hi, every one
In "The Smart Card Cryptographic Service Provider Cookbook"
whose URL is http://msdn2.microsoft.com/en-us/library/ms953432.aspx,
there is a "PIN caching" Design Considerations. I read it one time and
again and again, but still can not get its mean. How can I add the PIN
to the cache with the logon ID for the security context of the current
thread?
I notice it is very important, because the "Microsoft Base Smart Card Crypto Provider"
can behave correctly with "checkpoint SecureClient NGX R60 HFA2" in
vista, but my csp can not work perfectly. Checkpoint SecureClient's
SR_Service.exe is a service, it call csp at first and then create a
child process SR_CAPI.exe with normal user's identity. The SR_CAPI.exe
calls csp to generate rsa key pair and sigh hash, during this progress
the csp will require smart card PIN with prompting PIN dialog, so
SR_CAPI.exe process's csp state is smart card pin provided and the pin
is cached in process. Now the SR_Service.exe will call csp to sign hash
using the generated rsa key bu SR_CAPI.exe, the "Microsoft Base Smart Card Crypto Provider" does not
prompt PIN dialog as this process's csp state is pin provided and cached,
but my csp will prompt to require smart card PIN.
According to smart card csp cookbook, the pin cache is
per-process, so the pin cache should not shared by two process, but why
"Microsoft Base Smart Card Crypto Provider" can share the pin cache in
two different process?

I expect your help!

Skybird Le

.

Relevant Pages

  • RE: Certs on smart card, re-prompting for PIN (Internet Explorer 6)
    ... If the CERTIFICATE is protected with PIN, ... Most Smart Card software allows the caching of the PIN (ie. won't prompt ... would establish an SSL connection between client and server - and the ... I notice that the smart card "middleware" has settings for either ...
    (microsoft.public.platformsdk.security)
  • Re: Re[2]: Whats the mean of PIN cache in smart card csp
    ... The PIN cache described by the Smart Card Cryptographic Service Provider ... smart card CSP. ...
    (microsoft.public.platformsdk.security)
  • Certs on smart card, re-prompting for PIN (Internet Explorer 6)
    ... The problem that we're encountering is that when we do the above, we are seeing the popup window asking for the smart card PIN, but this window is appearing multiple times, sometimes 10-20 times before we start seeing the initial partial webpage. ... I notice that the smart card "middleware" has settings for either caching the PIN, or for the middleware temporarily copying the client cert into the Certificate Store, and I'm pretty sure if we enabled either or both of these settings, that we'd avoid the multiple popup PIN windows. ... As mentioned above, the smart card middleware appears to have some settings that would also prevent the re-prompting for the PIN, but the workstations are locked down, and even if we could it would be a major process to get approval to change the settings, so I'm wondering if there is possibly something else that we can do to avoid the popup PIN windows from re-appearing. ...
    (microsoft.public.platformsdk.security)
  • Re: Caching PIN
    ... I know how a CSP name associated with a card be identified.But after getting ... The usual approach taken by smart card CSP's implementors is to cache the ... PIN in the context of the CSP dll, thus you don't need to care about the ... I had a list of available readers on the system and the PIN is ...
    (microsoft.public.platformsdk.security)
  • Re: Certs on smart card, re-prompting for PIN (Internet Explorer 6)
    ... Its purely a sign of poor card handling of your middleware. ... As mentioned we're using Apache as the webserver. ... normally the PIN is needed only when the PRIVATE KEY ... If the server requires authentication of EACH request then the smart card ...
    (microsoft.public.platformsdk.security)